Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
17-10-2024 23:08
Static task
static1
Behavioral task
behavioral1
Sample
b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe
Resource
win10v2004-20241007-en
General
-
Target
b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe
-
Size
3.6MB
-
MD5
e70caad17f0c1c37639d4480316fffa9
-
SHA1
c07067ed7a3ff4596c3ab9a6020ddbaac94dec98
-
SHA256
b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b
-
SHA512
836ecde6dc7bb3062cbb515290c0e0155f70a70eb062a44e81e149171e0f7100d2c1f4724b14c7c0f5d20f09d3c5c3a6c1cad439a8e4be35f79249706fa74e5e
-
SSDEEP
98304:AYGYf3CX3N22bWEvXtsPK3GaQMQT7RpgRHLIcS4OiZrq1DfPHNADtV6v+2gYJbKI:AX3NcoaaOgRHLIcS4O7NADtV6v+
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 3028 b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe 3028 b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe 3028 b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe 3028 b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe 3028 b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe"C:\Users\Admin\AppData\Local\Temp\b751b15faaa92cf43b111732e190a16b55499beba808fff8185bfebe4f8be37b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3028